A $387.5 million theft from Bitget’s hot wallets has forced the industry to confront a trade-off it usually avoids discussing directly: the same permissionless rails that let anyone build on top of XRP Ledger, Zcash or a cross-chain swap protocol also make it structurally difficult, sometimes impossible, to claw back stolen funds once they start moving. In the days since the breach, investigators have traced the attacker’s path through a decentralized exchange aggregator, a cross-chain swap protocol and a shielded privacy pool, and each hop has tested whether “permissionless” is a feature or a liability when the money in motion is stolen.

Bitget CEO Gracy Chen framed the tension directly, telling Cointelegraph that decentralization is “a design principle, not a shield for facilitating known stolen funds,” according to Cointelegraph. The protocols the funds moved through, though, were built specifically to not discriminate between legitimate and illegitimate transactions, which is exactly what’s now under scrutiny.

Key Takeaways

  • Bitget lost about $387.5 million on Sept. 24 after attackers tricked its internal approval system into signing off on fraudulent withdrawals, with SlowMist tracing the first intrusion to a zero-day exploit on Aug. 31, 25 days earlier.
  • THORChain declined to freeze funds tied to the exploit, and Chainflip brokers rejected a direct deposit from the attackers only for automated scripts to route the same funds through CoW Protocol into Chainflip anyway, according to news.bitcoin.com.
  • Attacker-linked wallets moved about $3.9 million in ZEC, roughly 15% of the stolen Zcash, into Zcash’s Ironwood shielded pool, hiding senders, recipients and amounts, according to CoinDesk.
  • Circle and Tether froze only about $320,000 of the stolen assets, and XRP’s own base layer gives Ripple no protocol-level mechanism to freeze the roughly 102.93 million XRP drained from Bitget.
  • Multiple reports attribute the theft to North Korean state-linked actors, and Chen said she is “not very optimistic” about full recovery, citing the limited recovery rate from Bybit’s 2025 hack.

A 25-Day Dwell Time Before the Withdrawal Tool Fired

The intrusion long predated the theft itself. SlowMist traced the earliest malicious activity in Bitget-linked systems to Aug. 31, when an attacker exploited a zero-day vulnerability in a third-party security product the firm calls “Product A,” running a hidden script that read a database password from an environment variable, according to news.bitcoin.com and Cointelegraph. Similar activity surfaced on two more nodes on Sept. 23 and Sept. 25, meaning the environment was compromised weeks before any funds moved.

The theft itself unfolded fast once triggered. At 16:07 UTC on Sept. 24, the attacker used an internal employee’s identity to access the management platform of a second security product, “Product B,” attempting to inject system commands. By 17:49 UTC, a custom withdrawal tool, later recovered from deleted files, began forging risk-control parameters and constructing withdrawal requests. The first onchain transfer landed at 18:31 UTC (93 TRX, followed 11 seconds later by 0.84 ETH), and the last compiled transfer came at 21:23 UTC, about two hours and 52 minutes after the first. Arkham Intelligence found that $228 million left in just 18 minutes across seven chains, with roughly $153 million of that in XRP, per news.bitcoin.com. Chen told Cointelegraph the breach did not touch Bitget’s private keys or cold wallets: attackers instead obtained “high-level internal credentials” and issued fraudulent withdrawal commands that the approval system read as legitimate.

Where the Stolen Funds Exposed DeFi’s Design Choices

Once the funds were out, the laundering path became the real test of permissionless infrastructure. THORChain declined to block or freeze funds connected to the exploit, letting assets route through its decentralized exchange protocol, a decision the Finobird roundup says drew criticism from observers who argue permissionless architecture enables laundering at scale. SlowMist founder Cos said Mistrack’s Trackagent tool caught suspected North Korean hackers combining CoW Protocol, a DEX aggregator, with Chainflip’s cross-chain swap contracts to convert proceeds into bitcoin automatically, according to news.bitcoin.com. Notably, Chainflip brokers had rejected a direct deposit from the same attackers just one day earlier and returned the funds, only for the automated CoW Protocol route to reach Chainflip’s contracts anyway. Cos warned that Chainflip’s anti-money laundering and know-your-transaction checks lag behind the hackers’ routing.

Separately, wallets tied to the attacker moved about $3.9 million in Zcash, roughly 15% of the ZEC stolen, into Ironwood, Zcash’s newest shielded pool, in three transfers, according to CoinDesk. Shielded transactions hide sender, recipient and amount, though CoinDesk notes investigators can still see how much enters the pool and may use timing and transaction values as clues when funds later surface on public addresses. CoinDesk also traced about $6.3 million in separate ether-to-bitcoin swaps through THORChain from one attacker-linked wallet.

Why Exchanges Can’t Simply Freeze It Back

The freezing tools that do exist barely dented the total. Circle and Tether froze only about $320,000 in stolen assets tied to the exploit, a fraction of the $387.5 million haul, per the Finobird roundup. XRP settles on its own base layer, so Ripple has no protocol-level mechanism to freeze the roughly 102.93 million XRP, worth about $157 million at the time, that the attacker distributed across five wallets before moving roughly 54 million of it. As the roundup put it, “the Bitget incident underscores a structural reality: permissionless networks cannot selectively reverse transactions, and that immutability cuts both ways for exchanges and their users.”

What to Watch

SlowMist’s investigation remains ongoing, with findings current only as of Sept. 29, so the full intrusion chain between Product A and Product B is still being mapped. Chen said she is “not very optimistic” about recovering the full $388 million, pointing to the limited recovery seen after Bybit’s 2025 hack as a reference point, according to Cointelegraph. Whether Chainflip, CoW Protocol or other DEX infrastructure tighten their AML and KYT screening in response, as Cos suggested is needed, will shape how much of the remaining funds stay traceable as they continue to move across chains.

Sources